Wtcms Project
Wtcms Project Wtcms: vulnerabilidades y CVE
Wtcms Project Wtcms tiene 18 vulnerabilidades publicadas, 3 de ellas en los últimos 12 meses. 2 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE18
Últimos 12 meses3
Críticas2
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2025-13786 | Media (5.5) | 0.56% | — | 30 nov 2025 | A vulnerability was detected in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Impacted is the function fetch of the file /index.php. Performing manipulation of the argument content results in code… |
| CVE-2025-13783 | Baja (2.1) | 0.32% | — | 30 nov 2025 | A security flaw has been discovered in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. This affects the function check/uncheck/delete of the file… |
| CVE-2025-13782 | Media (5.5) | 0.38% | — | 30 nov 2025 | A vulnerability was identified in taosir WTCMS up to 01a5f68a3dfc2fdddb44eed967bb2d4f60487665. Affected by this issue is the function delete of the file application/Admin/Controller/SlideController.class.php of the… |
| CVE-2024-48239 | Media (4.8) | 0.24% | — | 25 oct 2024 | An issue was discovered in WTCMS 1.0. In the plupload method in \AssetController.class.php, the app parameters aren't processed, resulting in Cross Site Scripting (XSS). |
| CVE-2024-48238 | Media (4.7) | 0.29% | — | 25 oct 2024 | WTCMS 1.0 is vulnerable to SQL Injection in the edit_post method of /Admin\Controller\NavControl.class.php via the parentid parameter. |
| CVE-2024-48237 | Crítica (9.8) | 0.46% | — | 25 oct 2024 | WTCMS 1.0 is vulnerable to Incorrect Access Control in \Common\Controller\HomebaseController.class.php. |
| CVE-2020-20349 | Media (5.4) | 0.53% | — | 1 sept 2021 | WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link address field under the background links module. |
| CVE-2020-20348 | Media (5.4) | 0.53% | — | 1 sept 2021 | WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the link field under the background menu management module. |
| CVE-2020-20347 | Media (5.4) | 0.50% | — | 1 sept 2021 | WTCMS 1.0 contains a stored cross-site scripting (XSS) vulnerability in the source field under the article management module. |
| CVE-2020-20345 | Media (5.4) | 0.55% | — | 1 sept 2021 | WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the page management background which allows attackers to obtain cookies via a crafted payload entered into the search box. |
| CVE-2020-20344 | Media (5.4) | 0.50% | — | 1 sept 2021 | WTCMS 1.0 contains a reflective cross-site scripting (XSS) vulnerability in the keyword search function under the background articles module. |
| CVE-2020-20343 | Media (6.5) | 0.43% | — | 1 sept 2021 | WTCMS 1.0 contains a cross-site request forgery (CSRF) vulnerability in the index.php?g=admin&m=nav&a=add_post component that allows attackers to arbitrarily add articles in the administrator background. |
| CVE-2019-16719 | Media (6.5) | 0.52% | — | 23 sept 2019 | WTCMS 1.0 allows index.php?g=admin&m=index&a=index CSRF with resultant XSS. |
| CVE-2019-8911 | Media (6.1) | 0.83% | — | 18 feb 2019 | An issue was discovered in WTCMS 1.0. It has stored XSS via the third text box (for the website statistics code). |
| CVE-2019-8910 | Alta (8.8) | 0.61% | — | 18 feb 2019 | An issue was discovered in WTCMS 1.0. It allows index.php?g=admin&m=setting&a=site_post CSRF. |
| CVE-2019-8909 | Alta (7.5) | 1.8% | — | 18 feb 2019 | An issue was discovered in WTCMS 1.0. It allows remote attackers to cause a denial of service (resource consumption) via crafted dimensions for the verification code image. |
| CVE-2019-8908 | Crítica (9.8) | 2.3% | — | 18 feb 2019 | An issue was discovered in WTCMS 1.0. It allows remote attackers to execute arbitrary PHP code by going to the "Setting -> Mailbox configuration -> Registration email template" screen, and uploading an image file, as… |
| CVE-2018-10267 | Alta (8.8) | 0.52% | — | 22 abr 2018 | WTCMS 1.0 has a CSRF vulnerability to add an administrator account via the index.php?admin&m=user&a=add_post URI. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.